Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

WP Directory Kit SQL Injection Risk Through Unauthenticated Access

CVE-2026-28001 · published 2 months ago
Summary

WP Directory Kit versions 1.5.4 and below are vulnerable to SQL injection attacks. This means an attacker can potentially access or manipulate sensitive data without needing a password. To stay safe, update to the latest version of WP Directory Kit.

What to do
  • Update wpdirectorykit wp directory kit to version 1.5.5.
Affected software
VendorProductAffected versions
wpdirectorykit wp directory kit <= 1.5.4
Fix: upgrade to 1.5.5
Original advisory text
WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability
Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
9.3 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published13 Aug 2026
Updated4 Nov 2026
First seen13 Aug 2026
Sources
CVE-2026-28001 · NVD
CVE-2026-28001 · MITRE
Track software like this
Free during beta